CVE-2025-39360: Grace Mag PHP File Inclusion Vulnerability

CVE-2025-39360 Overview

CVE-2025-39360 is a PHP Local File Inclusion (LFI) vulnerability in the everestthemes Grace Mag WordPress theme. The flaw affects all versions of Grace Mag up to and including 1.1.5. It originates from improper control of filename input passed to PHP include or require statements, classified under [CWE-98].

An attacker can manipulate file path parameters to load arbitrary local PHP files within the web server context. Successful exploitation can lead to source code disclosure, configuration leakage, or execution of attacker-controlled PHP code if the attacker can plant files on the host.

Critical Impact
Exploitation enables local file inclusion that can escalate to remote code execution, exposing the full WordPress instance and underlying server.

Affected Products

everestthemes Grace Mag WordPress theme versions through 1.1.5
WordPress installations using the vulnerable grace-mag theme
Sites that have not upgraded beyond Grace Mag 1.1.5

Discovery Timeline

2025-04-24 - CVE-2025-39360 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-39360

Vulnerability Analysis

The vulnerability resides in the Grace Mag theme's handling of user-controlled input that flows into a PHP include or require statement. The theme fails to validate or sanitize the supplied filename before passing it to file inclusion functions. An attacker can supply a crafted path to load arbitrary .php files from the local file system.

Exploitation requires user interaction, such as enticing a victim with sufficient privileges to follow a malicious link. Attack complexity is high, but no authentication is required. Successful inclusion executes the targeted PHP file in the context of the WordPress process, threatening confidentiality, integrity, and availability of the site.

Root Cause

The root cause is improper control of a filename used in a PHP include or require statement [CWE-98]. The theme accepts attacker-influenced input and concatenates it into a file path without enforcing an allowlist, restricting the directory, or stripping path traversal sequences. This pattern enables the PHP runtime to resolve and execute files outside the intended template scope.

Attack Vector

The attack vector is network-based and triggered through an HTTP request that targets the vulnerable theme endpoint. An unauthenticated attacker crafts a URL containing a manipulated file path parameter and lures a victim to load it. When the request is processed, the PHP interpreter includes the attacker-specified file, executing any PHP code it contains. Attackers commonly chain LFI with log poisoning, session file inclusion, or wrapper abuse to achieve remote code execution.

No verified public proof-of-concept code is available. Refer to the Patchstack advisory for Grace Mag for additional technical context.

Detection Methods for CVE-2025-39360

Indicators of Compromise

HTTP requests to Grace Mag theme endpoints containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f
Requests with file path parameters referencing sensitive files such as /etc/passwd, wp-config.php, or PHP session files in /tmp
Use of PHP stream wrappers such as php://filter, php://input, or data:// in query strings targeting the theme
Unexpected PHP errors or warnings in web server logs referencing include() or require() calls within wp-content/themes/grace-mag/

Detection Strategies

Inspect WordPress access logs for anomalous query parameters targeting files inside wp-content/themes/grace-mag/
Deploy web application firewall (WAF) rules that block path traversal and PHP wrapper patterns against theme endpoints
Correlate web server, PHP-FPM, and authentication logs to identify file inclusion attempts followed by suspicious process activity

Monitoring Recommendations

Monitor for unexpected reads of wp-config.php, .htaccess, and other sensitive WordPress files by the web server user
Alert on outbound network connections initiated by the PHP worker process, which may indicate post-exploitation activity
Track theme and plugin version inventory across WordPress hosts to surface installations still running Grace Mag 1.1.5 or earlier

How to Mitigate CVE-2025-39360

Immediate Actions Required

Identify all WordPress sites running the Grace Mag theme and confirm the installed version
Disable or remove the Grace Mag theme on any site running version 1.1.5 or earlier until a patched release is applied
Restrict access to the WordPress administrative interface and theme endpoints through IP allowlisting where feasible
Review web server and PHP error logs for prior exploitation attempts targeting the theme

Patch Information

At the time of NVD publication, fixed version information is not listed in the CVE record. Consult the Patchstack Grace Mag Theme Vulnerability advisory and the everestthemes vendor channel for the latest patched release and update instructions.

Workarounds

Configure PHP with open_basedir restrictions to limit which directories the web server can include
Disable allow_url_include in php.ini to prevent remote wrapper-based inclusion chains
Deploy WAF signatures that block path traversal payloads and PHP stream wrapper schemes on theme URLs
Replace the Grace Mag theme with a maintained alternative if no vendor patch becomes available

bash

# Configuration example: harden php.ini against LFI exploitation
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"